CloudFilter: Practical Confinement of Sensitive Data Across Clouds

云计算旨在彻底改变传统的服务交付方式。它使公司、研究机构和政府组织能够在云提供商支持的共享ICT基础设施中整合服务。这降低了所有权和管理成本，允许按需扩展服务并提高能源效率。然而，安全方面的考虑是采用云计算的一个实际障碍。云提供商整合来自多个服务的数据，当其安全性受到损害时，可能导致大范围的数据泄露。强大的云安全性很难实现，因为它要求云平台不能被托管的应用程序破坏，并且属于不同云租户的应用程序被隔离以防止数据泄漏。对于联合云来说就更难了，例如，当一个云提供商使用另一个提供商提供其某些服务时。这在软件即服务（SaaS）模型中很常见，在该模型中，提供者提供可以被其他提供者重用的高级服务。客户端和云提供商都有控制敏感数据传播的动机。客户通常对数据保护负有法律责任，云提供商希望防止托管敏感数据，以避免在安全事件发生后承担责任。CloudFilter项目探索了对跨多个云提供商的敏感数据传播进行控制的新方法。目标结果是一个实用的解决方案，允许客户和云提供商控制跨其系统传输的数据的敏感性，并防止可能违反数据传播策略的用户操作。我们的关键思想是提供应用程序级代理，以透明地监控从客户端到云提供商以及云提供商之间的数据传播。这些代理采用受分散信息流控制（DIFC）模型启发的数据标记方案，其中安全类表示传输数据的敏感性。当跨越域边界时，根据数据传播策略自动为数据附加标签。代理根据域策略对标签进行验证，检测和防止云域域之间未经授权的数据传播。

Cloud computing aims to revolutionise traditional ways of service delivery. It enables companies, research institutions and government organisations to consolidate services in a shared ICT infrastructure supported by cloud providers. This reduces ownership and management costs, allows services to scale on-demand and improves energy efficiency. Security considerations, however, are a practical obstacle for the adoption of cloud computing. Cloud providers consolidate data from multiple services, which may result in wide-spread data disclosure when their security is compromised.Strong cloud security is hard to achieve because it requires that the cloud platform cannot be compromised by hosted applications and that applications belonging to different cloud tenants are isolated to prevent data leakage. Itis even harder for federated clouds, i.e. when a cloud provider uses another provider for some of its services. This is common in a Software-as-a-Service (SaaS) model, in which a provider offers a high-level service that can be reused by other providers. Both clients and cloud providers have an incentive to control the propagation of sensitive data. Clients are often legally responsible for data protection, and cloud providers want to prevent hosting sensitive data to avoid liability claims after security incidents.The CloudFilter project explores novel methods for exercising control over sensitive data propagation across multiple cloud providers. The targeted outcome is a practical solution that allows clients and cloud providers to control the sensitivity of data that is transferred across their systems and to prevent user actions that would violate data dissemination policies. Our key idea is to provide application-level proxies that transparently monitor data propagation from clients to cloud providers and between cloud providers. These proxies employ a data labelling scheme inspired by decentralised information flow control (DIFC) models, in which security classes express the sensitivity of transfered data. When crossing domain boundaries, labels are attached to data automatically based on data dissemination policies. Proxies verify labels according to domain policies to detect and prevent unauthorised data propagation between cloud domain domains.